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MEMORANDUM  FOR  COMMANDER  IN  CHIEF,  U.S.  PACIFIC  COMMAND 

SUBJECT:  Audit  Report  on  U.S.  Pacific  Command  Year  2000  Issues 
(Report  No.  99-031) 


We  are  providing  this  report  for  your  information  and  use.  We  considered 
management  comments  on  a  draft  of  this  report  in  preparing  the  final  report. 

Management  comments  on  the  draft  of  this  report  conformed  to  the 
requirements  of  DoD  Directive  7650.3,  and  left  no  unresolved  issues.  Therefore,  no 
additional  comments  are  required. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  Questions  on  the  audit 
should  be  directed  to  Mr.  Richard  B.  Vasquez  at  (703)  604-9094  (DSN  664-9094) 
email  <  rbvasquez@dodig.osd.mil  >,  Ms.  Dianna  J.  Pearson  at  (703)  604-9063 
(DSN  664-9063)  email  <  djpearson@dodig.osd.mil  >,  or  Ms.  Mary  Lu  Ugone  at 
(703)  604-9049  (DSN  664-9049)  email  <  mlugone@dodig.osd.mil  > .  See  Appendix  E 
for  the  report  distribution,  which  includes  all  unified  commands  so  that  self  evaluations 
of  year  2000  readiness  may  be  facilitated.  The  audit  team  members  are  listed  inside  the 
back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 


Report  No.  99-031 

(Project  No.  8AS-0006.04) 


November  3, 1998 


►ffice  of  the  Inspector  General,  DoD 


U.S.  Pacific  Command  Year  2000  Issues 
Executive  Summary 


Introduction.  This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge.  For  a 
listing  of  audit  projects  addressing  the  issue,  see  the  year  2000  webpage  on  the  IGnet  at 
http://www.ignet.gov. 

Information  technology  systems  have  typically  used  two  digits  to  represent  the  year, 
such  as  “98”  representing  1998,  to  conserve  electronic  storage  and  reduce  operating 
costs.  With  the  two-digit  format,  however,  the  year  2000  is  indistinguishable  from 
1900.  As  a  result  of  that  ambiguity,  computers  and  associated  systems  and  application 
programs  that  use  dates  to  calculate,  compare,  and  sort  could  generate  incorrect  results 
when  working  with  years  after  1999. 

Audit  Objectives.  The  overall  audit  objective  was  to  evaluate  the  status  of  the 
progress  of  the  U.S.  Pacific  Command  in  resolving  its  year  2000  computing  issues. 

Our  audit  focused  on  the  following  year  2000  issues:  leadership  support  and 
awareness,  management  and  resolution  strategy,  system  assessments,  prioritization, 
system  interfaces,  testing,  risk  analysis  and  contingency  planning,  and  support  received 
from  responsible  Service  executive  agents. 

Audit  Results.  The  U.S.  Pacific  Command  has  established  a  year  2000  program  and 
has  taken  positive  actions  to  address  and  resolve  its  year  2000  problem.  However, 

U.S.  Pacific  Command  needs  to  improve  its  year  2000  program  to  minimize  the 
adverse  impact  of  year  2000  date  processing  on  its  mission  and  on  its  mission-critical 
systems.  Unless  the  U.S.  Pacific  Command,  along  with  the  Joint  Staff,  the  Sendees, 
and  the  Defense  agencies,  makes  further  progress  on  mitigating  its  year  2000  risks,  the 
U.S.  Pacific  Command  may  be  unable  to  fully  execute  its  mission.  See  Part  I  for 
details  of  the  audit  results. 

Summary  of  Recommendations.  We  recommend  that  the  Commander  in  Chief, 

U.S.  Pacific  Command,  include  its  reconciling  and  updating  responsibility  for  the 
U.S.  Pacific  Command  systems  inventory  in  the  U.S.  Pacific  Command  Year  2000 
Management  Plan,  establish  offices  of  primary  responsibility  to  monitor  and  track  the 
status  of  supporting  systems,  modify  the  systems  inventory  to  clearly  identify  critical 
year  2000  data  elements,  develop  system  and  operational  contingency  plans,  develop  a 
complete  inventory  of  all  facility  infrastructure  systems  and  equipment  and  determine 


the  overall  responsibility  for  those  items,  and  use  selected  conunand  and  joint  exercises 
to  test  year  2000  scenarios  and  contingency  plans  in  an  operational  environment  when 
possible. 

Management  Comments.  The  U.S.  Pacific  Command  concurred  with  all  of  the 
recommendations  except  the  one  recommending  use  of  selected  command  and  joint 
exercises  to  test  year  2000  scenarios  and  contingency  plans  in  an  operational 
environment.  The  U.S.  Pacific  Command  stated  that  it  will  use  separately  developed 
operational  evaluations  and  Joint  Chiefs  of  Staff-directed  Positive  Response  exercises  to 
test  year  2000  compliance  and  contingency  planning.  See  Part  I  for  a  summary  of 
management  comments  and  Part  III  for  the  complete  text  of  the  comments. 

Audit  Response.  The  U.S.  Pacific  Command  actions  met  the  intent  of  the 
recommendation  on  the  use  of  selected  command  and  joint  exercises  to  test  year  2000 
scenarios  and  contingency  plans  in  an  operational  environment;  therefore,  management 
comments  are  considered  responsive  and  no  further  comments  are  required.  We  also 
commend  U.S.  Pacific  Command  for  expediting  the  necessary  actions  to  address  the 
recommendations  of  the  report. 
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Part  I  -  Audit  Results 


Audit  Background 

The  year  2000  (Y2K)  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform  date- 
related  ftmctions  before,  on,  or  after  the  turn  of  the  century.  The  Y2K  problem 
is  rooted  in  die  way  that  automated  information  systems  record  and  compute 
dates.  For  the  past  several  decades,  systems  have  typically  used  two  digits  to 
represent  the  year,  such  as  “98”  representing  1998,  to  conserve  on  electronic 
data  storage  and  to  reduce  operating  costs.  With  the  two-digit  format,  however, 
the  Y2K  is  indistinguishable  from  1900.  As  a  result  of  the  ambiguity, 
computers  and  associated  system  and  application  programs  that  use  dates  to 
calculate,  compare,  or  sort  could  generate  incorrect  results  when  working  with 
years  following  1999.  Calculating  Y2K  dates  is  further  complicated  because  the 
Y2K  is  a  leap  year,  the  first  century  leap  year  since  1600.  The  computer 
systems  and  applications  must  also  recognize  February  29,  2000,  as  a  valid 
date. 

Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  Federal  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  Y2K 
problem  and  that  the  head  of  each  agency  ensure  that  efforts  to  address  the  Y2K 
problem  receive  the  highest  priority  attention  in  the  agency. 

DoD  Y2K  Management  Strategy.  In  his  role  as  the  DoD  Chief  Information 
Officer,  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  the  "DoD  Year  2000  Management 
Plan”  (DoD  Management  Plan)  in  April  1997.  The  DoD  Management  Plan 
provides  the  overall  DoD  strategy  and  guidance  for  inventorying,  prioritizing, 
fixing,  or  retiring  systems,  and  monitoring  progress.  The  DoD  Management 
Plan  states  that  the  DoD  Chief  Information  Officer  has  overall  responsibility  for 
overseeing  the  DoD  solution  to  the  Y2K  problem.  Also,  the  DoD  Management 
Plan  makes  die  DoD  Components  responsible  for  implementing  the  five-phase 
Y2K  management  process.  The  DoD  Management  Plan  includes  a  description 
of  die  five-phase  Y2K  management  process.  The  DoD  Management  Plan,  For 
Signature  Draft  Version  2.0,  June  1998,  accelerates  the  target  completion  dates 
for  the  renovation,  validation,  and  implementation  phases.  The  new  target 
completion  date  for  implementing  mission-critical  systems  is 
December  31,  1998. 

In  a  January  20,  1998,  memorandum  for  the  heads  of  executive  departments  and 
agencies,  the  Office  of  Management  and  Budget  established  a  new  target  date  of 
March  1999  for  implementing  all  corrective  actions  to  all  systems.  The  new 
target  completion  dates  are  September  1998  for  the  renovation  phase  and 
January  1999  for  the  validation  phase. 

On  August  7,  1998,  the  Secretary  of  Defense  asked  the  Chairman  of  the  Joint 
Chiefs  of  Staff  to  develop  a  joint  Y2K  operational  evaluation  program  by 
October  1,  1998.  On  October  2,  1998,  the  Chairman  of  the  Joint  Chiefs  of 
Staff  provided  the  Joint  Staff  Y2K  Operational  Evaluation  Program  Plan  to  the 


Secretary  of  Defense.  On  August  24,  1998,  the  Deputy  Secretary  of  Defense 
directed  that  each  Principal  Staff  Assistant  of  the  Office  of  the  Secretary  of 
Defense  provide  plans  for  Y2K-related  end-to-end  testing  of  their  respective 
functional  process  by  November  1,  1998. 

Public  Law  105-271,  “Year  2000  Information  and  Readiness  Disclosure  Act,” 
October  19,  1998,  is  intended  to  encourage  the  disclosure  and  exchange  of 
information  about  computer  processing  problems,  solutions,  test  practices  and 
test  results,  and  related  matters  in  connection  with  the  transition  to  the  Y2K. 

The  Joint  Chiefs  of  Staff.  The  Chairman  of  the  Joint  Chiefs  of  Staff  is  the 
principal  military  advisor  to  the  President,  the  Secretary  of  Defense,  and  the 
National  Security  Council.  The  Joint  Chiefs  of  Staff  have  no  executive 
authority  to  command  the  combatant  forces.  The  Secretaries  of  the  Military 
Departments  assign  all  forces  under  their  jurisdiction  to  the  unified  commands 
to  perform  missions  assigned  to  those  commands. 

The  Joint  Staff.  The  Joint  Staff  assists  the  Chairman  of  the  Joint  Chiefs 
of  Staff  with  unified  strategic  direction  of  the  combatant  forces,  unified 
operation  of  the  combatant  commands,  and  integration  into  an  efficient  team  of 
land,  naval,  and  air  forces.  The  Joint  Staff  Director,  Command,  Control, 
Communications,  and  Computer  Systems  (J-6),  is  designated  by  the  Chairman 
of  the  Joint  Chiefs  of  Staff  to  oversee  the  unified  commands  and  Joint  Staffs 
implementation  of  the  DoD  Management  Plan. 

Year  2000  Action  Plan.  The  Joint  Staff  Year  2000  Action  Plan, 

March  1998,  provides  the  unified  commands  and  Joint  Staff  directorates  with 
the  corporate  strategy  and  management  approach  for  addressing  the  Y2K 
problem.  The  Action  Plan  uses  the  accelerated  target  completion  dates  for  the 
renovation,  validation,  and  implementation  phases.  The  Action  Plan  states  that 
the  unified  commands  should  target  December  31,  1998,  to  complete  all  Y2K 
efforts. 

U.S.  Pacific  Command.  The  U.S.  Pacific  Command  (PACOM)  is  one  of  the 
nine  unified  commands  of  the  Department  of  Defense.  It  was  established  as  a 
unified  command  on  January  1,  1947,  as  an  outgrowth  of  the  command 
structure  used  during  World  War  II  and  is  the  oldest  and  largest  of  the  United 
States’  nine  unified  commands.  The  PACOM  area  of  responsibility  includes  50 
percent  of  the  earth’s  surface  and  two-thirds  of  the  world’s  population.  It 
encompasses  more  than  100  million  square  miles,  stretching  from  the  west  coast 
of  North  and  South  America  to  the  east  coast  of  Africa  and  from  the  Arctic  in 
the  north  to  the  Antarctic  in  the  south.  It  also  includes  Alaska  and  Hawaii  and 
eight  U.S.  Territories.  The  overall  mission  of  PACOM  is  to  promote  peace, 
deter  aggression,  respond  to  crises,  and,  if  necessary,  fight  and  win  to  advance 
security  and  stability  throughout  the  Asia-Pacific  region. 

The  PACOM  is  supported  by  Component  commands  from  each  Service:  the 
U.S.  Army  Pacific  Command,  U.S.  Pacific  Fleet  Command,  Marine  Forces 
Pacific  Command,  and  U.S.  Pacific  Air  Forces  Command.  In  addition, 
PACOM  exercises  combatant  command  over  four  sub-unified  commands  within 
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the  Pacific  region.  The  sub-unified  commands  are  the  U.S.  Forces  Japan,  U.S. 
Forces  Korea,  Alaskan  Command,  and  Special  Operations  Command  Pacific. 


Audit  Objectives 

The  overall  audit  objective  was  to  evaluate  the  status  of  the  progress  of  PACOM 
in  resolving  its  Y2K  computing  issues.  Our  audit  focused  on  the  following  Y2K 
issues:  leadership  support  and  awareness,  management  and  resolution  strategy, 
system  assessments,  prioritization,  system  interfaces,  testing,  risk  analysis  and 
contingency  planning,  and  support  received  from  responsible  Service  executive 
agents.  We  did  not  review  the  management  control  program  related  to  the 
overall  audit  objective  because  DoD  recognizes  the  Y2K  issue  as  a  material 
management  control  weakness  area  in  the  FY  1997  Annual  Statement  of 
Assurance.  See  Appendix  A  for  a  discussion  of  the  audit  scope,  methodology, 
and  summary  of  prior  coverage. 
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Status  of  the  U.S.  Pacific  Command 
Year  2000  Program 

The  PACOM  has  established  a  Y2K  program  and  has  taken  positive 
actions  to  address  and  resolve  its  Y2K  problem.  However,  PACOM 
needs  to  improve  its  Y2K  program  to  minimize  the  adverse  impact  of 
Y2K  date  processing  on  its  mission  and  on  its  mission-critical  systems. 
Specifically,  the  PACOM  needs  to: 

•  include  its  reconciling  and  updating  responsibility  for  the 
PACOM  systems  inventory  in  the  PACOM  Y2K  Management  Plan, 

•  establish  offices  of  primary  responsibility  to  monitor  and 
track  the  status  of  supporting  systems, 

•  modify  the  systems  inventory  to  clearly  identify  critical  Y2K 
data  elements, 

•  develop  system  and  operational  contingency  plans  to  establish 
alternate  procedures  to  accomplish  the  mission, 

•  develop  a  complete  inventory  of  all  facility  infrastructure 
systems  and  equipment  and  determine  the  overall  responsibility  for  those 
items,  and 


•  use  selected  command  and  joint  exercises  to  test  Y2K 
scenarios  and  contingency  plans  in  an  operational  environment  when 
possible. 

Unless  PACOM,  along  with  the  Joint  Staff,  the  Services,  and  the 
Defense  agencies,  makes  further  progress  on  mitigating  its  Y2K  risks, 
the  PACOM  may  be  unable  to  fully  execute  its  mission. 


Y2K  Program  Management 

The  PACOM  has  taken  numerous  positive  actions  to  address  the  Y2K  problem, 
and  PACOM  senior  management  has  reinforced  the  importance  of  the  PACOM 
Y2K  program  throughout  the  command. 

The  PACOM  has  taken  the  following  actions  as  part  of  its  effort  to  address  the 
Y2K  problem: 

•  prepared  a  draft  Y2K  Management  Plan; 

•  designated  the  Command,  Control,  Communications,  and  Computer 
Systems  Directorate  (J-6)  as  the  PACOM  Y2K  program  office; 
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•  assigned  a  Y2K  project  officer  to  serve  as  the  Y2K  focal  point  for 
PACOM,  as  well  as  its  Service  Component  commands  and  sub-unified 
commands; 

•  established  the  Y2K  Working  Group  to  heighten  visibility  of  the  Y2K 
problem;  and 

•  established  the  Y2K  Executive  Steering  Committee  to  obtain  more 
participation  from  PACOM  senior  leaders. 

Y2K  Management  Plan.  The  PACOM  developed  a  draft  Y2K  Management 
Plan,  May  28,  1998,  to  promote  management  awareness  and  involvement  in 
developing  and  executing  the  PACOM  Y2K  strategy.  The  execution  of 
PACOM  Y2K  strategy  is  focused  on  the  duties  and  responsibilities  of  the 
PACOM  Y2K  Working  Group.  As  of  June  1998,  the  PACOM  Y2K 
Management  Plan  was  in  draft  form,  but  has  been  distributed  and  coordinated 
through  the  PACOM  Working  Group.  The  PACOM  Y2K  Management  Plan  is 
currently  being  updated  to  include  the  roles  and  responsibilities  of  the  newly 
established  Y2K  Executive  Steering  Committee. 

The  PACOM  Y2K  Management  Plan  identifies  the  roles  and  responsibilities  for 
the  members  of  the  PACOM  Y2K  Working  Group;  however,  it  does  not 
identify  the  need  to  update  and  reconcile  the  PACOM  systems  inventory.  The 
Y2K  project  officer  and  Y2K  Working  Group  should  be  responsible  for 
updating  and  reconciling  the  PACOM  systems  inventory. 

Y2K  Working  Group.  The  PACOM  Deputy  Commander  in  Chief  established 
the  PACOM  Y2K  Working  Group  in  November  1997.  The  Y2K  Working 
Group  is  comprised  of  working  level  representatives  from  the  PACOM 
headquarters  functional  directorates,  Component  commands,  and  sub-unified 
commands.  The  Y2K  Working  Group  is  tasked  to  develop  a  list  of  critical 
warfighting  systems  and  a  cohesive  PACOM  plan  of  action.  It  also  serves  as 
the  focal  point  to  address  potential  Y2K  failures  within  the  command  as  well  as 
being  responsible  for  monitoring  Y2K  efforts. 

Y2K  Executive  Steering  Committee.  The  PACOM  Chief  of  Staff  established 
the  PACOM  Y2K  Executive  Steering  Committee  in  June  1998  to  obtain  more 
active  participation  from  senior  leaders.  The  Y2K  Executive  Steering 
Committee  consists  of  senior  leaders  (0-6  and  above)  from  PACOM 
headquarters  ftmctional  directorates  and  components.  It  will  develop  a 
consolidated  and  validated  PACOM  mission-critical  systems  list,  determine 
which  mission-critical  systems  will  require  a  contingency  plan,  and  develop  the 
strategy  for  contingency  plans.  The  PACOM  Y2K  Executive  Steering 
committee  held  its  first  meeting  in  July  1998. 

Service  Component  Commands  and  Sub-Unified  Commands.  The  PACOM 
is  increasing  its  awareness  of  and  involvement  in  Y2K  issues  over  its  Service 
Component  commands  and  sub-unified  commands  to  assess  the  impact  on  its 
mission  for  mission-critical  systems  and  to  develop  a  complete  theater  picture. 

In  May  1998,  PACOM  requested  Y2K  status  information  from  the  Service 
Component  commands  and  sub-unified  commands.  In  August  1998,  the 
Secretary  of  Defense  issued  a  memorandum  that  required  each  Unified 
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Commander-in-Chief  to  review  the  status  of  Y2K  implementation  within  his 
command  and  the  commands  of  subordinate  Components.  The  Unified 
Commanders-in-Chief  are  required  to  report  the  status  of  Y2K  implementation 
to  the  Secretary  of  Defense  on  a  quarterly  basis.  We  visited  or  contacted  all 
Service  Component  commands  and  sub-unified  commands.  Although  we  did 
not  make  recommendations  directly  to  the  Service  Component  commands  and 
sub-unified  commands,  we  suggested  that  they  increase  their  efforts  to  provide 
the  Y2K  information  required  by  the  U.S.  Pacific  Command  and  Joint  Staff. 
See  Appendix  B  for  a  discussion  on  the  Service  Component  commands  and 
Appendix  C  for  a  discussion  on  the  sub-unified  commands. 


Systems  Inventory 

Managed  Systems.  The  PACOM  is  responsible  for  three  managed  systems, 
one  of  which  is  mission  critical.  The  PACOM  is  actively  addressing  Y2K 
issues  for  these  managed  systems  and  has  taken  positive  actions  to  work  towards 
their  Y2K  compliance.  We  obtained  information  on  two  of  the  three  managed 
systems,  including  the  Command  Center  local  area  network,  which  is  the  only 
mission-critical  system  that  PACOM  manages.  The  PACOM  is  developing 
management,  testing,  and  contingency  plans  for  the  Command  Center  local  area 
network,  and  testing  and  contingency  plans  for  the  Command  and  Control 
Support  System. 

Supporting  Systems.  The  PACOM  does  not  have  a  process  in  place  to  obtain 
the  visibility  and  status  of  Services  and  Defense  agencies  mission-critical 
supporting  systems.  The  PACOM  has  identified  the  lack  of  information  as  an 
area  of  concern.  See  Appendix  D  for  the  PACOM  area  of  concern.  The 
PACOM  needs  to  establish  offices  of  primary  responsibility  who  will: 

•  monitor  and  track  the  status  of  Services  and  Defense  agencies 
mission-critical  supporting  systems, 

•  join  with  functional  counterparts  at  the  Joint  Staff  and  other  unified 
commands  to  obtain  the  status  of  Services  and  Defense  agencies  mission-critical 
supporting  systems,  and 

•  report  the  status  of  Services  and  Defense  agencies  mission-critical 
supporting  systems  to  the  PACOM  Y2K  project  office. 

Inventory  List.  The  PACOM  has  developed  an  initial  inventory  list  of 
managed  and  supporting  systems,  but  it  needs  to  improve  the  list  for  it  to  be  an 
effective  Y2K  management  tool.  Although  the  PACOM  inventory  list  includes 
some  information  about  the  systems,  data  elements  could  be  added  or  modified 
to  provide  a  clear  overall  picture  of  PACOM  systems.  At  a  minimum,  the 
PACOM  inventory  list  should  clearly  identify  the  following: 

•  managed  and  supporting  systems, 

•  mission-critical  and  non-mission-critical  systems. 
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•  a  system  executive  agent, 

•  a  PACOM  office  of  primary  responsibility  who  will  monitor  and 
track  the  status  of  Services  and  Defense  agencies  mission-critical  supporting 
systems, 

•  system  compliance  status, 

•  target  dates  for  system  fixes, 

•  whether  contingency  plans  will  be  developed  and  a  projected  plan 
completion  date,  and 

•  other  information  needed  to  match  the  complete  DoD  Y2K  database 
that  the  Assistant  Secretary  of  Defense  (Command,  Control,  Communications, 
and  Intelligence)  has  developed. 

The  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications  and  Intelligence)  developed  a  DoD  Y2K  database.  In  an 
undated  memo,  the  DoD  Y2K  Oversight  and  Contingency  Planning  Office 
decided  to  post  the  DoD  Y2K  database  to  the  Office  of  the  Assistant  Secretary 
of  Defense  (Command,  Control,  Communications  and  Intelligence)  web  page. 
In  September  1998,  the  DoD  Y2K  office  removed  the  DoD  Y2K  database  from 
the  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications  and  Intelligence)  web  page  due  to  lack  of  updated  information. 
To  provide  further  assistance  to  the  warfighting  community  on  determining  the 
Y2K  status  of  supporting  systems,  the  Joint  Staff  has  taken  initiatives  to 
compensate  for  the  continuing  problems  in  making  that  information  available 
through  other  channels.  To  date,  the  Joint  Staff  has  posted  an  extract  of  the 
DoD  Y2K  database  on  the  Secret  Internet  Protocol  Routing  Network 
(SIPRNET).  The  DoD  Y2K  database  will  facilitate  the  ability  of  PACOM  and 
other  unified  commands  to  monitor  the  progress  of  their  supporting  systems  and 
to  prepare  contingency  plans  for  their  mission  areas. 


Contingency  Plans 

The  PACOM  Y2K  Management  Plan  states  that  the  functional  directorates,  the 
Service  Component  commands,  and  the  sub-unified  commands  must  have 
contingency  plans  for  the  unique  systems  or  applications  that  may  not  be 
corrected  in  time,  as  outlined  in  the  DoD  Y2K  Management  Plan.  Also,  the 
PACOM  Y2K  Executive  Steering  Committee  identified  the  requirement  to 
determine  which  mission-critical  systems  will  require  a  contingency  plan,  and  to 
develop  the  strategy  for  contingency  plans.  The  PACOM  has  recognized  that  it 
needs  to  develop  contingency  plans  for  its  managed  systems.  The  PACOM 
offices  of  primary  responsibility  should  request  contingency  plans  for  mission- 
critical  supporting  systems  from  the  executive  agents,  and  assess  them  for  their 
impact  on  operations. 

The  Joint  Chiefs  of  Staff  Year  2000  Action  Plan  requires  that  the  unified 
commands  conduct  sufficient  planning  and  establish  alternate  procedures  to 
successfully  complete  their  mission,  while  system  program  managers  and 
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technical  staff  make  necessary  Y2K  corrections.  Alternate  procedures  must 
apply  to  day-to-day  peacetime  operations 'as  well  as  to  warfighting  and 
peacekeeping  operations.  The  PACOM  must  monitor  both  the  status  of  its 
mission-critical  systems  and  their  completion  schedules  when  developing 
contingency  plans.  The  PACOM  directorates  need  to  coordinate  with  the  Joint 
Staff,  the  Services,  and  the  other  unified  commands  to  determine  realistic 
completion  schedules  for  the  common  mission-critical  systems  and  develop  both 
system  and  operational  contingency  plans  to  establish  alternate  procedures  to 
accomplish  their  missions. 


Facility  Infrastructure 

The  PACOM  headquarters  is  located  at  a  Marine  Corps  host  installation.  The 
Marine  Corps  Facility  Infrastructure  Y2K  Action  Plan,  May  1998,  states  that 
the  base/station  commander  has  the  overall  responsibility  to  identify  and  correct 
facility  infrastructure  Y2K  problems.  The  Marine  Corps  Base  Hawaii  is 
responsible  for  facility  infrastructure  at  Camp  Smith  and  has  identified  a  point 
of  contact  for  facility  infrastructure  Y2K  issues  and  data  sharing.  The  PACOM 
did  an  initial  Y2K  assessment  of  facility  infrastructure  in  October  1997  and 
identified  general  categories  of  facility  infrastructure  systems,  which  have  been 
cleared  of  Y2K  issues  by  the  maintenance  contractor  or  local  subject-matter 
experts  who  provide  PACOM  with  the  services.  The  PACOM  identified  the 
commercial  power  system  and  the  card  swipe  system  that  will  be  affected  by 
Y2K  issues. 

However,  PACOM  has  not  developed  a  complete  inventory  of  all  facility 
infrastructure  systems  and  equipment  and  has  not  determined  the  overall 
responsibility  for  those  items.  The  Marine  Corps  Base  Hawaii  is  responsible  for 
the  facility  infrastructure  systems;  and  PACOM  is  responsible  for  any  unique 
equipment  that  has  been  added  to  the  buildings  (generators  and  card  swipe 
systems).  For  example,  the  Marine  Corps  Base  Hawaii  is  responsible  for  the 
standard  door  locks  installed  in  the  buildings,  but  PACOM  is  responsible  for 
any  special  lock  added  for  heightened  security.  The  PACOM  needs  to  develop 
a  complete  inventory  of  all  facility  infrastructure  systems  and  equipment  and 
needs  to.  determine  the  overall  responsibility  for  those  items. 


Using  Selected  Command  and  Joint  Exercises  for  Y2K 
Operational  Evaluation 

Because  of  time  constraints  posed  by  Y2K  issues,  using  selected  command  and 
joint  exercises  to  test  Y2K  scenarios  may  assist  PACOM  to  make  further 
progress  to  identify  and  resolve  Y2K  problems.  Further,  using  selected 
command  and  joint  exercises  would  provide  PACOM  and  the  unified  commands 
with  die  opportunity  to  correct  Y2K  interoperability  issues  because  of  system 
interdependencies  and  interfaces  or  would  provide  alternative  measures  if 
resolution  of  Y2K  issues  is  not  timely.  The  other  Inspector  General,  DoD, 
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unified  command  Y2K  reports  that  have  been  issued  recommended  that  the  Joint 
Staff  and  unified  commands  integrate  Y2K  scenarios  into  operational 
requirements  for  joint  exercises  to  determine  the  extent  of  potential  Y2K  impact 
on  warfighter  operations.  The  Joint  Staff  and  the  unified  commands  concurred 
with  the  recommendation. 

Public  Law  105-261,  “National  Defense  Authorization  Act  for  FY  1999,” 
October  17,  1998,  Section  334  requires  that  the  Secretary  of  Defense  submit  to 
Congress,  not  later  than  December  15,  1998,  a  plan  for  the  execution  of  a 
simulated  Y2K  as  part  of  military  exercises  to  evaluate,  in  an  operational 
environment,  the  extent  to  which  information  technology  and  national  security 
systems  involved  in  those  exercises  will  successfully  operate  during  the  actual 
year  2000.  Section  334  states  that  military  exercises  are  those  conducted  by  the 
DoD  during  die  period  beginning  on  January  1,  1999,  and  ending  on 
September  30,  1999,  including  those  conducted  under  the  Chairman  of  the  Joint 
Chiefs  of  Staff  Exercise  Program.  In  addition.  Section  334  requires  functional 
end-to-end  tests  or  tests  through  a  Defense  Major  Range  and  Test  Facility  Base 
as  an  alternative  testing  method  for  those  information  technology  or  national 
security  systems  for  which  a  simulated  Y2K  test  as  part  of  a  military  exercise  is 
not  feasible  or  presents  undue  risk.  The  Secretary  of  Defense  may  exclude  a 
particular  information  technology  or  national  security  system  from  the  Y2K 
simulation  phase  of  the  exercise  if  the  Secretary  determines  that  the  system 
would  be  incapable  of  performing  reliably  during  the  Y2K  simulation  phase  of 
the  exercise.  In  this  case,  the  system  excluded  shall  be  replaced  in  accordance 
with  the  Y2K  contingency  plan  for  the  system. 

On  August  7,  1998,  the  Secretary  of  Defense  asked  the  Chairman  of  the  Joint 
Chiefs  of  Staff  to  develop  a  joint  Y2K  operational  evaluation  program  by 
October  1,  1998.  On  October  2,  1998,  the  Chairman  of  the  Joint  Chiefs  of 
Staff  provided  the  Joint  Staff  Y2K  Operational  Evaluation  Program  Plan  to  the 
Secretary  of  Defense.  Also,  on  August  24,  1998,  the  Deputy  Secretary  of 
Defense  directed  that  each  Principal  Staff  Assistant  of  the  Office  of  the 
Secretary  of  Defense  verify  that  all  functions  under  his  or  her  purview  will 
continue  unaffected  by  Y2K  issues.  The  designated  Office  of  the  Secretary  of 
Defense  Principal  Staff  Assistant  must  provide  plans  for  Y2K-related  end-to-end 
testing  of  each  process  by  November  1,  1998. 

In  June  1998,  the  Vice  Chairman  of  the  Joint  Chiefs  of  Staff  asked  the  unified 
commands,  the  Services,  and  the  Defense  agencies  to  provide  a  synopsis  of  the 
operational  evaluation  plan,  the  unified  command  involvement  in  the  Y2K 
process,  and  requested  feedback  on  Y2K  operational  evaluation  opportunities. 
The  Y2K  operational  evaluation  plan  will  encourage  joint  exercises, 
demonstrations,  mission-readiness  assessments,  tests,  or  other  opportunities  to 
evaluate  Y2K  readiness.  The  goal  of  Y2K  operational  evaluations  is  to  assure 
warfighters  that  their  key  mission-critical  systems  will  not  fail  because  of  Y2K 
effects  on  isolated  systems  or  on  part  of  the  interconnected  systems  environment 
in  which  warfighting  and  peacekeeping  missions  are  conducted.  In 
September  1998,  the  Joint  Staff  hosted  its  second  Y2K  operational  evaluation 
conference.  The  intent  of  the  conference  is  for  0-6  level  operators  and  exercise 
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planners  to  discuss  their  respective  unified  command  Y2K  operational 
evaluations  in  context  of  critical  missions  and  functions  that  must  be 
accomplished. 

Performing  command  and  joint  exercises  to  test  Y2K  interoperability  of  system 
interdependencies  and  interfaces  may  not  be  possible  if  the  Services  and 
agencies  have  not  implemented  the  necessary  Y2K  corrections  to  the  required 
systems.  In  such  cases,  contingency  plans  should  be  tested  in  an  operational 
environment  to  help  PACOM  assess  its  capability  to  continue  operations  if  the 
systems  fail  because  of  Y2K  problems. 


Conclusion 

Although  PACOM  established  a  Y2K  program  and  has  taken  positive  actions  to 
address  and  resolve  its  Y2K  problem,  it  needs  to  improve  its  Y2K  program  to 
minimize  the  adverse  effect  of  Y2K  date  processing  on  its  mission  and  its 
mission-critical  systems.  Unless  PACOM,  along  with  the  Joint  Staff,  the 
Services,  and  the  Defense  agencies,  makes  further  progress  on  mitigating  Y2K 
risks,  it  may  be  unable  to  fully  execute  its  mission.  We  recognize  the  inherent 
problems  confronting  PACOM  and  other  system  users  who  must  rely  on  system 
owners  to  carry  out  die  necessary  remediation  measures.  The  DoD  Y2K 
database  will  facilitate  the  ability  of  PACOM  and  other  unified  commands  to 
monitor  the  progress  of  their  supporting  systems  and  to  prepare  contingency 
plans  for  their  mission  areas.  Copies  of  this  report  are  being  provided  to  all 
unified  commands  so  that  self  evaluations  Of  Y2K  readiness  may  be  facilitated. 


Recommendations,  Management  Comments,  and  Audit 
Response 

We  recommend  that  the  Commander  in  Chief,  U.S.  Pacific  Command: 

1.  Include  the  reconciling  and  updating  responsibility  for  the  U.S. 
Pacific  Command  systems  inventory  in  the  U.S.  Pacific  Command  Year 
2000  Management  Plan. 

2.  Establish  offices  of  primary  responsibility  to: 

(a)  monitor  and  track  the  status  of  Services’  and  Defense 
agencies’  mission-critical  supporting  systems, 

(b)  join  with  functional  counterparts  at  the  Joint  Staff  and 
other  unified  commands  to  obtain  the  status  of  Services’  and  Defense 
agencies’  mission-critical  supporting  systems,  and 
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(c)  report  the  status  of  Services’  and  Defense  agencies’ 
mission-critical  supporting  systems  to  the  U.S.’ Pacific  Command  Year  2000 
Project  Office. 

3.  Modify  the  systems  inventory  to  clearly  identify  critical  year  2000 
data  elements. 

4.  Develop  system  and  operational  contingency  plans  that  will 
establish  alternate  procedures  to  successfully  accomplish  the  mission  if  year 
2000  disruptions  occur. 

5.  Develop  a  complete  inventory  of  all  facility  infrastructure  systems 
and  equipment  and  determine  the  overall  responsibility  for  those  items. 

6.  Use  selected  command  and  joint  exercises  to  test  year  2000 
scenarios  and  contingency  plans  in  an  operational  environment  when 
possible. 

Management  Comments.  The  PACOM  concurred  with  Recommendations  1 . 
through  5.,  stating  progress  made  and  future  actions  for  each  recommendation. 
However,  PACOM  did  not  concur  with  Recommendation  6. ,  stating  that  it  will 
use  separately  developed  operational  evaluations  and  Joint  Chiefs  of  Staff- 
directed  Positive  Response  exercises  to  test  Y2K  compliance  and  contingency 
plans. 

Audit  Response.  The  PACOM  comments  are  considered  responsive. 

Although  PACOM  nonconcurred  with  Recommendation  6.,  PACOM  has  taken 
action  that  met  the  intent  of  the  recommendation.  We  commend  PACOM  for 
expediting  the  necessary  actions  to  address  the  recommendations  of  the  report. 
No  further  comments  are  required. 
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Appendix  A.  Audit  Process 


This  is  one  in  a  series  of  reports  being  issued  by  the  Inspector  General,  DoD,  in 
accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  Y2K  computing  challenge.  For  a 
listing  of  audit  projects  addressing  the  issue,  see  the  Y2K  web  page  on  the  IGnet 
at  http://www.ignet.gov. 


Scope 

We  reviewed  and  evaluated  the  status  of  the  progress  of  PACOM  in  resolving 
its  Y2K  computing  issue.  We  evaluated  the  Y2K  efforts  of  PACOM  compared 
with  those  efforts  described  in  the  DoD  Management  Plan  issued  by  the 
Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence)  in  April  1997.  We  obtained  documentation  including  the  PACOM 
Y2K  Management  Plan  and  systems  inventory  status  information  as  of 
June  1998,  and  we  used  the  information  to  assess  efforts  relating  to  the  multiple 
phases  of  managing  die  Y2K  problem.  • 

DoD-Wide  Corporate  Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  the 
Department  of  Defense  has  established  6  DoD-wide  corporate-level  performance 
objectives  and  14  goals  for  meeting  the  objectives.  This  report  pertains  to 
achievement  of  the  following  objectives  and  goals. 

•  Objective:  Prepare  now  for  an  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  war  fighting  capabilities.  (DoD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objectives  and  goals.  This 
report  pertains  to  achievement  of  the  following  functional  area  objectives  and 
goals. 

•  Information  Technology  Management  Functional  Area. 

Objective:  Become  a  mission  partner.  Goal:  Serve  mission 
information  users  as  customers.  (ITM-1.2) 

•  Information  Technology  Management  Functional  Area. 

Objective:  Provide  services  that  satisfy  customer  information  needs. 
Goal:  Modernize  and  integrate  Defense  information  infrastructure. 
(ITM-2.2) 
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•  Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  services  that  satisfy  customer  information  needs. 
Goal:  Upgrade  technology  base.  (ITM-2.3) 

General  Accounting  Office  High-Risk  Area.  In  its  identification  of  risk 
areas,  the  General  Accounting  Office  has  specifically  designated  risk  in 
resolution  of  the  Y2K  problem  as  high.  This  report  provides  coverage  of  that 
problem  and  of  the  overall  Information  Management  and  Technology  high-risk 
area. 


Methodology 

Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  at  PACOM  from  June  through  August  1998,  in  accordance  with 
auditing  standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  use  computer- 
processed  data  for  this  audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DpD.  Further  details  are  available  upon  request. 

Management  Control  Program.  We  did  not  review  the  management  control 
program  related  to  the  overall  audit  objective  because  DoD  recognized  the  Y2K 
issue  as  a  material  management  control  weakness  area  in  the  FY  1997  Annual 
Statement  of  Assurance. 

Summary  of  Prior  Coverage 

The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conducted  multiple  reviews  related  to  Y2K  issues.  General  Accounting  Office 
reports  can  be  accessed  over  the  Internet  at  http://www.gao.gov.  Inspector 
General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http://www.ignet.gov.  The  following  Y2K  reports  have  been  issued  on  other 
unified  commands. 

Inspector  General,  DoD,  Report  No.  98-194,  “U.S.  Atlantic  Command  Year 
2000  Issues,”  August  27,  1998. 

Inspector  General,  DoD,  Report  No.  98-188,  “U.S.  Space  Command  Year 
2000  Issues,”  August  18,  1998. 

Inspector  General,  DoD,  Report  No.  98-173,  “U.S.  Central  Command  Year 
2000  Issues,”  July  2,  1998. 

Inspector  General,  DoD,  Report  No.  98-129,  U.S.  Special  Operations 
Command  Year  2000  Issues,”  May  8,  1998. 

Army  Audit  Agency,  Memorandum  Report  No.  AA  98-292,  “U.S.  European 
Command  Year  2000  Issues,”  July  30,  1998. 
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Army  Audit  Agency,  Memorandum  Report  No.  AA  98-291,  “U.S.  Southern 
Command  Year  2000  Issues,”  July  31,  1998. 

Air  Force  Audit  Agency  Project  No.  98066033,  “U.S.  Strategic  Command 
Year  2000  Issues,”  September  29,  1998. 

Air  Force  Audit  Agency  Project  No.  98066032,  “U.S.  Transportation 
Command  Year  2000  Issues,”  September  25,  1998. 
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Appendix  B.  Status  of  the  Service  Component 
Commands 


The  PACOM  is  increasing  the  awareness  of  its  Service  Component  commands 
to  assess  the  Y2K  impact  on  the  PACOM  mission.  In  May  1998,  PACOM 
requested  die  Service  Components  to  provide  Y2K  status  information.  The 
following  paragraphs  summarize  the  status  information  sent  to  PACOM  and  also 
summarize  discussions  with  the  Service  Components. 

U.S.  Army  Pacific  Command.  The  U.S.  Army  Pacific  Command 
(USARPAC)  has  taken  an  aggressive  approach  in  addressing  its  Y2K  issues  and 
has  divided  its  Y2K  effort  into  two  categories:  weapon  and  automation 
systems,  and  infrastructure  devices.  The  USARPAC  also  prepared  a  Y2K 
Management  Plan  outlining  its  direction  in  dealing  with  the  Y2K  issue  and 
established  a  Y2K  homepage  on  the  Internet  to  share  information  throughout 
USARPAC  and  with  other  DoD  agencies.  The  USARPAC  developed  a  detailed 
inventory  of  its  mission-critical  systems  to  provide  USARPAC  with  oversight 
for  systems  that  could  affect  its  mission  operations.  The  Y2K  strategy  of 
USARPAC  is  to  maintain  a  list  of  mission-critical  systems  being  used;  to 
revalidate  its  Y2K  status;  to  ensure  that  risk  management  and  contingency  plans 
are  in  place;  and  to  ensure  that  Y2K  fixes  are  applied  and  tested  and  that  system 
interface  issues  have  been  resolved.  Although  USARPAC  has  developed  a 
detailed  systems  inventory  to  execute  its  Y2K  strategy,  it  should  also  identify 
the  program  offices  that  manage  systems,  projected  completion  dates,  and  local 
points  of  contact  for  mission-critical  systems. 

U.S.  Pacific  Fleet  Command.  The  U.S.  Pacific  Fleet  Command 
(CINCPACFLT)  has  not  completed  its  systems  inventory.  The  Navy  Systems 
Commands  are  responsible  for  identifying  the  standard  Navy  systems  that  they 
manage,  which  are  called  programs  of  record.  The  CINCPACFLT  is 
responsible  for  identifying  all  other  systems,  called  non-programs  of  record. 

The  CINCPACFLT  divided  its  Y2K  effort  between  the  regional  commands  and 
the  type  commands,  which  consist  of  ships,  submarines,  and  aircraft  carriers, 
and  obtained  contractor  assistance  for  its  Y2K  effort.  The  first  facility 
infrastructure  data  call  occurred  in  September  1997  with  no  problems; 
however,  CINCPACFLT  performed  a  prototype  facility  infrastructure 
assessment  in  May  1998  and  found  numerous  Y2K  issues.  Therefore, 
CINCPACFLT  initiated  another  facility  infrastructure  and  systems  inventory  to 
be  completed  by  September  1998.  Because  CINCPACFLT  has  not  identified  its 
inventory,  it  is  unable  to  assess  the  magnitude  of  its  Y2K  problem. 

Specifically,  CINCPACFLT  has  not  identified  which  systems  are  critical  to  its 
mission.  Without  a  complete  inventory,  CINCPACFLT  is  unable  to  establish 
the  timeframes  required  to  assess  the  inventory  of  systems,  fix  and  replace 
noncompliant  systems,  test  compliant  systems,  and  implement  the  certified 
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compliant  systems.  Because  CINCPACFLT  cannot  assess  its  Y2K  status,  we 
could  not  determine  its  Y2K  impact  on  the  PACOM  mission.  We  encourage 
CINCPACFLT  to  raise  its  Y2K  status  to  senior  management  within  the 
PACOM,  the  Navy,  and  the  DoD  Chief  Information  Officer  and  Y2K  Project 
Office. 

U.S.  Pacific  Air  Forces  Command.  The  U.S.  Pacific  Air  Forces  Command 
(PACAF)  has  taken  action  to  determine  whether  the  computer  systems 
supporting  its  mission  will  operate  correctly  after  December  31,  1999.  As  of 
June  1998,  the  PACAF  and  its  air  bases  use  113  systems  managed  by  the 
Services  and  other  agencies,  of  which  only  20  are  Y2K  compliant.  Two 
systems  are  not  expected  to  be  compliant  until  after  December  1998. 
Additionally,  PACAF  has  10  unique  systems,  none  of  which  is  considered 
critical  to  die  PACAF  mission.  The  PACAF  is  the  host  of  Hickam  Air  Force 
Base  and  therefore  is  responsible  for  the  facility  infrastructure.  The  PACAF 
drafted  a  contingency  plan  template  to  incorporate  facility  infrastructure  and 
information  technology  issues  into  one  plan.  Additionally,  PACAF  created  a 
Y2K  project  team,  which  has  completed  eight  of  the  nine  staff  assistance  visits. 
The  PACAF  is  concerned  about  not  getting  timely  and  accurate  information 
from  program  managers  on  its  support  systems. 

Marine  Forces  Pacific  Command.  The  Marine  Forces  Pacific  Command 
(MARFORPAC)  works  under  the  guidance  and  direction  provided  by  the 
Marine  Corps  Headquarters,  Office  of  the  Chief  Information  Officer  Y2K 
Action  Team.  The  MARFORPAC  established  a  Y2K  coordinator  to  represent 
the  command  in  the  PACOM  Y2K  working  group.  The  coordinator  is 
responsible  for  maintaining  a  database  inventory  of  information  technology 
hardware,  software,  and  systems,  and  for  tracking  the  status  of  systems  that 
MARFORPAC  uses.  However,  the  status  of  the  systems  is  not  being 
disseminated  to  the  users  of  the  systems.  Also,  MARFORPAC  has  not 
established  Y2K  focal  points  within  the  functional  units  and  directorates.  The 
MARFORPAC  has  identified  75  systems  that  it  uses  but  does  not  manage.  Of 
the  75  systems,  22  were  identified  as  mission  critical.  The  MARFORPAC 
needs  to  provide  an  inventory,  including  mission-critical  systems,  to  the  Marine 
Corps  Y2K  Project  Office.  We  encourage  MARFORPAC  to  establish  Y2K 
focal  points  within  all  functional  units  and  directorates  to  participate  in  the  Y2K 
program.  We  also  encourage  MARFORPAC  to  provide  its  Y2K  inventory  and 
its  mission-critical  systems  status  to  PACOM  and  the  Marine  Corps. 

In  response  to  our  discussion  draft  report,  MARFORPAC  stated  that  it  has  taken 
action  to  enhance  information  sharing  across  commands  and  functional 
divisions.  In  addition,  MARFORPAC  stated  that  it  has  taken  the  following 
actions: 

•  established  Y2K  focal  points  within  the  functional  divisions, 

•  established  a  Y2K  working  group  with  participation  from  all 
functional  divisions,  and 

•  initiated  appropriate  Y2K  reporting. 
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The  PACOM  is  increasing  the  awareness  and  involvement  of  its  sub-unified 
commands  for  Y2K  issues  to  develop  a  complete  theater  picture.  In  May  1998, 
PACOM  sent  a  message  to  all  sub-unified  commands  except  the  Special 
Operations  Command  Pacific  requesting  Y2K  information  on  the  status  of  the 
headquarters  and  supporting  service  Y2K  efforts,  mission-critical  systems,  any 
unique  areas,  and  contingency  plans.  The  following  paragraphs  summarize  the 
status  information  sent  to  PACOM  and  also  summarize  the  discussions  with  the 
sub-unified  commands. 

U.S.  Forces  Japan.  The  U.S.  Forces  Japan  (USFJ)  headquarters  identified 
local  area  networks  that  connect  the  headquarters  staff  to  command-unique 
systems.  The  local  area  networks  consist  entirely  of  commercial  of-the-shelf 
products,  and  USFJ  does  not  anticipate  any  major  problems  with  these  systems. 
All  local  area  network  components  are  Y2K  compliant  or  will  be  Y2K 
compliant  before  July  1999.  The  USFJ  has  also  initiated  a  test  program  for  the 
local  area  networks  to  verify  vendors’  Y2K  compliance  claims.  Other  systems 
that  USFJ  uses  are  common  DoD  systems  that  Services  or  other  agencies 
manage.  The  USFJ  Y2K  project  officer  is  tracking  the  status  of  these  common 
DoD  systems;  however,  he  stated  that  his  office  could  not  ensure  the  Y2K 
compliance  of  these  common  DoD  systems.  The  USFJ  has  three  categories  of 
mission-critical  systems  and  is  not  preparing  contingency  plans  for  the  local  area 
networks  (command-unique  systems).  The  USFJ  will  develop  command- 
specific  contingency  plans  if  and  when  it  determines  that  applicable  Services  and 
agencies  are  unable  to  ensure  Y2K  compliance  of  the  systems  that  they  manage. 

The  USFJ  Y2K  status  is  for  the  headquarters  staff  only.  The  USFJ  Service 
Components  report  their  Y2K  status  through  the  Service  Component  channels. 
Although  the  USFJ  Y2K  status  did  not  contain  anything  about  facility 
infrastructure,  a  base  working  group  is  addressing  facility  infrastructure  issues. 
We  encourage  the  USFJ  to  complete  an  inventory,  assess  facility  infrastructure 
systems  and  equipment,  establish  clear  responsibility  for  those  items,  and 
develop  contingency  plans  for  the  local  area  networks  that  it  manages. 

U.S.  Forces  Korea.  The  U.S.  Forces  Korea  (USFK)  established  a  Y2K 
working  group  and  steering  committee,  which  is  chaired  by  the  Deputy  Chief  of 
Staff,  to  work  Y2K  issues.  The  USFK  reports  its  Y2K  status  to  the  Department 
of  the  Army  through  the  8th  U.S.  Army  Component.  The  USFK  addressed  the 
Y2K  issue  by  implementing  a  compliant  versus  noncompliant  strategy,  with  the 


19 


Appendix  C.  Status  of  the  Sub-Unified  Commands 


focus  on  finding  problems.  The  Dot)  Y2K  Management  Plan  endorses  a 
mission-critical  versus  non-mission-critical  strategy  so  that  mission-critical 
systems  are  given  priority.  We  encourage  USFK  to: 

•  identify  and  concentrate  on  its  mission-critical  systems  so  that  the 
appropriate  executive  agents  are  aware  of  the  systems  that  are  critical  to  USFK, 

•  complete  an  inventory,  assess  facility  infrastructure  systems  and 
equipment,  and  establish  clear  responsibility  for  those  items,  and 

•  inform  the  PACOM  Y2K  program  office  regularly  on  the  status  of  its 
Y2K  issues. 

In  response  to  our  discussion  draft  report,  USFK  provided  a  summarization  of 
their  Y2K  efforts.  The  USFK  listed  the  following  among  their  current  and 
future  efforts: 

•  work  on  contingency  plans  (mission  critical  as  their  priority), 

•  refine  systems  inventory  list  as  a  management  tool, 

•  work  on  U.S.-Korean  allied  systems  interfaces, 

•  conduct  operational  evaluations  in  joint  exercise  opportunities,  and 

•  establish  a  Korean  representative  on  the  USFK  working  group  and 
steering  committee. 

Special  Operations  Command  Pacific.  The  Special  Operations  Command  is 
taking  a  more  active  interest  in  the  Y2K  issues  of  its  Service  Components  and 
sub-unified  commands,  including  Special  Operations  Command  Pacific.  In 
May  1998,  the  Special  Operations  Command  hosted  a  Y2K  conference  to 
reinforce  the  importance  of  Y2K  efforts  throughout  the  command.  The  Special 
Operations  Command  will  be  issuing  additional  guidance  for  the  Service 
components  and  sub-unified  commands.  We  encourage  the  Special  Operations 
Command  Pacific  to  continue  to  develop  a  complete  inventory,  identify  its 
mission-critical  systems,  and  report  its  Y2K  status  to  the  Special  Operations 
Command  and  the  Pacific  Command. 

Alaskan  Command.  The  Alaskan  Command  (ALCOM)  developed  the 
ALCOM  headquarters  Y2K  status  and  is  developing  a  composite  ALCOM-based 
Y2K  status.  The  ALCOM  Service  Components  are  managed  through  Service 
Component  headquarters.  The  ALCOM  identified  mission-critical  systems  for 
all  functional  areas  of  the  headquarters  including  managed  and  supporting 
systems.  The  ALCOM  wide  area  network  is  the  only  managed  system,  and  it  is 
considered  to  be  mission  critical.  The  ALCOM  wide  area  network  is  based  on 
commercial  off-the-shelf  products  that  are  Y2K  compliant.  The  ALCOM  stated 
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that  it  actively  tests  the  wide  area  network  for  Y2K  compliance  and  that  it  has 
no  known  Y2K  issues  with  the  wide  area  network  that  would  require  a 
contingency  plan.  We  encourage  ALCOM  to: 

•  engage  senior  management  to  review  the  list  of  mission-critical 
systems, 

•  develop  contingency  plans  for  its  mission-critical  wide  area  network, 
and 

•  complete  an  inventory,  assess  facility  infrastructure  systems  and 
equipment,  and  determine  the  overall  responsibility  for  those  items. 
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Status  of  System  Information.  In  June  1998,  the  PACOM  expressed  concern 
to  the  Joint  Staff  on  the  lack  of  information  on  the  status  of  systems.  The 
PACOM  suggested  that  the  Joint  Staff  task  the  Services  and  system  executive 
agents  to  provide  a  functional  area  list  of  all  mission-critical  systems  for  which 
they  are  responsible.  The  PACOM  also  stated  that,  at  a  minimum,  the  list 
should  address  systems’  compliance  status,  functionality,  target  dates  for  fixes, 
whether  a  contingency  plan  will  be  developed  for  the  system,  and  a  projected 
plan  completion  date. 

The  Office  of  the  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications  and  Intelligence)  has  developed  a  DoD  Y2K  database.  In  a 
recent  undated  memo,  the  DoD  Y2K  Oversight  and  Contingency  Planning 
Office  decided  to  post  die  DoD  Y2K  database  to  the  Office  of  the  Assistant 
Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 
web  page.  In  September  1998,  the  DoD  Y2K  office  removed  the  DoD  Y2K 
database  from  the  Office  of  the  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications  and  Intelligence)  web  page  due  to  lack  of  updated 
information.  To  provide  further  assistance  to  the  warfighting  community  on 
determining  the  Y2K  status  of  supporting  systems,  the  Joint  Staff  has  taken 
initiatives  to  compensate  for  the  continuing  problems  in  making  that  information 
available  through  other  channels.  To  date,  the  Joint  Staff  has  posted  an  extract 
of  the  DoD  Y2K  database  on  the  Secret  Internet  Protocol  Routing  Network 
(SIPRNET).  The  DoD  Y2K  database  will  help  PACOM  and  other  unified 
commands  to  monitor  the  progress  of  their  supporting  systems  and  to  prepare 
contingency  plans  for  their  mission  areas. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and  Intelligence) 
Year  2000  Oversight  and  Contingency  Planning  Office 
Assistant  Secretary  of  Defense  (Public  Affairs) 


Joint  Staff 

Director,  Joint  Staff 


Department  of  the  Army 

Assistant  Secretary  of  the  Army  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Army 
Chief  Information  Officer,  Army 
Inspector  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Navy 

Chief  Information  Officer,  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 
Chief  Information  Officer,  Air  Force 
Inspector  General,  Department  of  the  Air  Force 
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Unified  Commands 

Commander  in  Chief,  U.S.  European  Command 
Commander  in  Chief,  U.S.  Pacific  Command 
Commander  in  Chief,  U.S.  Atlantic  Command 
Commander  in  Chief,  U.S.  Southern  Command 
Commander  in  Chief,  U.S.  Central  Command  ' 
Commander  in  Chief,  U.S.  Space  Command 
Commander  in  Chief,  U.S.  Special  Operations  Command 
Commander  in  Chief,  U.S.  Transportation  Command 
Commander  in  Chief,  U.S.  Strategic  Command 


Other  Defense  Organizations 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Information  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Inspector  General,  National  Imagery  and  Mapping  Agency 
Inspector  General,  National  Reconnaissance  Office 

Non-Defense  Federal  Organizations  and  Individuals 

Chief  Information  Officer,  General  Services  Administration 
Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 
Technical  Information  Center,  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 
Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
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Non-Defense  Federal  Organizations  and  Individuals  (cont’d) 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Governmental  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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U.S.  Pacific  Command  Comments 


COMMANDER  IN  CHIEF,  U.S.  PACIFIC  COMMAND 
{USCINCPAC) 

CAMP  H.M.  SMITH,  HAWAII  96061-4026 

J633 
7500 

Ser:  63U059-8 
5  Oct  98 

To:  INSPECTOR  GENERAL,  Department  of  Defense,  400  Army  Navy  Drive, 
Arlington,  Virginia  22202 

Subj*  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL  (DODIG)  DRAFT 
REPORT  ON  THE  U  S  PACIFIC  COMMAND  YEAR  2000  ISSUES  FOR  THE 
AUDIT  OF  THE  STATUS  OF  YEAR  2000  COMPUTING  ISSUES  WITHIN  THE 
JOINT  STAFF  AND  UNIFIED  COMMANDS  (NO  8AS-0006.04) 

Ref  (a)  DODIG  Draft  Report,  V  S  Pacific  Command  Year  2000  Issues'1  of  4  Sep  98 

1  DODIG  conducted  an  audit  in  June  1 998,  which  evaluated  the  status  of 
USCINCPAC's  progress  in  resolving  its  Year  2000  computing  issues. 

2  Reference  (a)  was  provided  for  review  and  comments  DODIG  recommended 
corrective  actions  for  the  Y2K  program.  We  concur  with  all  corrective  actions  except  the 
use  of  selected  command  and  joint  exercises  to  test  the  Y2K  scenarios  and 
contingencies  plans  in  an  operational  environment  Our  comments  to  the  DODIG's 
recommendations  are  as  follows 

a  ■ Include  the  reconciling  and  updating  responsibility  for  USCINCPAC  systems 
inventory  in  the  USPACOM  Y2K  Management  Plan  * 

-CONCUR  -  USCINCPAC  J6  is  responsible  for  reconciling  and  updating  Y2K  status  for 
the  USCINCPAC  systems  inventory.  This  responsibility  will  be  reflected  in  the  next 
revision  of  the  USPACOM  Y2K  Management  Plan  The  revision  will  also  include  an 
updated  Y2K  strategy  and  the  creation  of  an  additional  Y2K  working  group.  Estimated 
completion  date  for  the  revised  Plan  is  October  1998 

b.  ’ Establish  offices  of  primary  responsibility  to,  (a)  monitor  and  track  the  status  of 
Services’  and  Defense  agencies’  mission-critical  supporting  systems ,  (b)  join  with 
functional  counterparts  at  the  Joint  Staff  and  other  unified  commands  to  obtain  the 
status  of  Services *  and  Defense  agencies’  mission-critical  supporting  systems,  and  (c) 
report  the  status  of  Services’  and  Defense  agencies'  mission-critical  supporting  systems 
to  the  U  S.  Pacific  Command  year  2000  Project  Office / 

-CONCUR  -  Action  is  completed  USCINCPAC  has  designated  the  J6  Y2K  Team  as 
the  primary  office  of  responsibility  for  monitoring,  tracking  and  reporting  mission-critical 
supporting  systems.  The  USCINCPAC  Y2K  Working  Group,  consisting  of  members 
from  each  of  the  staff  directorates  and  component  commands,  work  with  their  functional 
counterparts  at  the  Joint  Staff  and  other  unified  commands  to  obtain  the  status  of 
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Services  and  Defense  agencies*  mission-critical  supporting  systems  The  Y2K  Team 
enters  the  compiled  status  into  the  USCINCPAC  Y2K  database  monthly. 

c  “Modify  the  systems  inventory  to  dearly  identify  critical  Y2K  data  elements 

-CONCUR  -  USCINCPAC's  database,  an  Inventory  list  of  managed  and  supporting 
systems,  will  be  modified  through  a  new  automated  method  USCINCPAC  J6  is 
developing  this  automated  method  to  extract  relevant  records/fields  from  the  OSD/C31 
Y2K  database.  The  resulting  database  will  clearly  identify  critical  Y2K  data  elements. 
Estimated  completion  date  is  November  1998. 

d  " Develop  system  and  operational  contingency  plans  to  establish  alternate 
procedures  to  accomplish  the  mission  if  year  2000  disruptions  occur "  System 
contingency  plans  for  HQ  USCINCPAC-unique  systems  are  in  place. 

-CONCUR  -  J6  is  working  with  J3  to  develop  operational  contingency  plans  as 
alternate  procedures  to  accomplish  the  mission  USCINCPAC  will  participate  in  the 
JCS*directed  Positive  Response  exercises  to  test  the  operational  contingency  plans 
Estimated  completion  date  is  June  1999. 

e  * Develop  a  complete  inventory  of  ail  facility  infrastmcture  systems  and  equipment 
and  determine  the  overall  responsibility  for  these  items " 

-CONCUR  -  Since  USCINCPAC  headquarters  is  located  at  a  Marine  Corps  host 
installation,  the  Marine  Corps  Base  Hawaii  (MCBH)  is  responsible  for  the  Y2K  status  of 
all  facility  Infrastructure  systems  USCINCPAC  J4  is  responsible  for  any  unique 
equipment  that  has  been  added  to  the  systems  The  inventory  list  of  all  facility 
infrastructure  systems  and  equipment  is  now  fifty-percent  complete  and  reflects  the 
responsible  agency  Estimated  completion  date  is  October  1998 

f  ‘Use  selected  command  and  joint  exercises  to  test  Y2K  scenarios  and 
contingency  plans  in  an  operational  environment  when  possible ” 

-NONCONCUR  -  Instead  of  using  command  and  joint  exercises,  USCINCPAC  will  use 
separately  developed  operational  evaluations  and  JCS-directed  Positive  Response 
exercises  to  test  Y2K  compliance  and  contingency  planning  We  have  created  an 
Operational  Evaluation  Working  Group  to  plan,  conduct,  and  analyze  two  operational 
evaluations  scheduled  for  Mar  and  May  1 999.  During  May  and  June  1999, 

USCINCPAC  will  participate  in  two  Positive  Response  command  post  exercises  to  test 
our  contingency  plans  for  strategic  deployment  and  sustainment  Estimated  completion 
date  for  all  scheduled  tests  is  June  1999. 
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3.  POC  is  CDR  A.  Allen,  J6336,  at  (808)  477-6715  (DSN  477-6715),  or  email 
allenaaO@hq  pacom  smil.mil. 


>*  JAMES  D.  BRYAN 


Brigadier  General,  USA 
Director  for  Command,  Control, 
Communications  and  Computer 
Systems 
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